# Consent Records Retention: How Long to Keep Proof of a Yes

Source: https://consentfence.com/blog/2026-11-03-consent-records-retention-period.html

Every consent banner creates records, and every record creates a question nobody asks during implementation: how long do we keep this. The banner vendor keeps logs for a plan dependent window, the privacy policy says something vague about as long as necessary, and the actual retention practice is whatever the default was on the day somebody installed the plugin.

That is a problem in both directions. Delete too early and you cannot demonstrate consent for processing that is still being challenged. Keep everything forever and the consent database itself becomes a personal data liability, holding identifiers long after the relationship they documented ended.

## What a record has to prove

A defensible consent record shows who consented, in practice an identifier or pseudonymous ID, when, to what: the purposes and the banner or notice version that described them, and how: the interface and action taken. Under GDPR the controller must be able to demonstrate consent, Article 7(1), which is the legal shape of the whole retention question. A record missing the notice version proves a click, not an informed yes.

Retention should therefore be tied to the processing the consent enabled, plus the window in which that processing can be questioned. While a customer's data is actively processed under that consent, the record is live evidence. After the processing ends, limitation periods for complaints and claims set the tail, and those vary by jurisdiction, which is why retention schedules are written per record type and market, not as one global number.

## The vendor default is not your policy

Banner platforms retain logs on their own schedule, often months on lower tiers. If your policy needs the record for the life of the customer relationship plus a tail, and the vendor deletes at six months, your evidence has a hole you will discover during an inquiry, which is the worst possible time. Export on a schedule into storage you control, and verify the export contains the notice version and purposes, not just a timestamp and an ID.

Our audit log export analysis in [Your Banner Speaks Six Languages. Your Consent Records Speak None.](https://consentfence.com/blog/2026-11-02-consent-banner-language-preference-storage.md) goes through the field level detail for a neighbouring platform context, and the vendor change notice work in [First Party Cookies Are Not Exempt Cookies](https://consentfence.com/blog/2026-11-02-consent-first-party-cookies-inventory.md) covers the related duty: when purposes or vendors change materially, old records describe an old consent, and re-asking is cleaner than interpreting. Retention and re consent are the same discipline viewed from two ends.

## Deletion is part of the design

Write the deletion rule when you write the retention rule: records are deleted or anonymised a set period after the underlying processing ends, the schedule is documented, and somebody owns running it. Anonymised records, timestamps and purposes without identifiers, can be kept longer for statistics without the same exposure, and for many questions the statistics are all you need.

Review the schedule when anything material changes: a new market, a new purpose, a platform migration. Consent records feel like plumbing until the day they are evidence. The organisations that handle inquiries calmly are the ones that treated them as evidence from the start, with a retention period they chose, wrote down, and can show.

## Frequently asked questions

### How long should consent records be kept?

At minimum while the processing based on that consent continues, plus a tail reflecting the period in which consent can be challenged or a complaint filed in your jurisdictions. There is no single statutory number; the period should be chosen per record type and market, documented, and tied to the processing it evidences.

### What must a consent record contain?

Who consented, when, what they consented to including the purposes and the version of the notice or banner shown, and how consent was given. Under GDPR Article 7(1) the controller must be able to demonstrate consent, and a record without the notice version demonstrates a click rather than an informed agreement.

### Can I rely on my banner vendor to store consent records?

Only after checking their retention against your policy. Vendor log retention is plan dependent and can be far shorter than the life of the processing. Export records on a schedule into storage you control and verify the export includes purposes and notice version, not just timestamps.

### Should consent records ever be deleted?

Yes. Keeping identifiers indefinitely creates its own personal data risk. Set a deletion or anonymisation rule that runs a defined period after the underlying processing ends, document it in the retention schedule, and assign an owner. Anonymised records can be kept longer for statistics.